Why is my Windows PC ignoring 802.1X on an Ethernet cable?

Because Windows does not run the Wired AutoConfig service by default, and without it a PC never answers 802.1X on a wired port at all — even when it is fully enrolled and joins the Wi-Fi perfectly.

This catches everybody, and it looks exactly like a broken certificate: no IP address, nothing in Passbeam's authentication log for that machine, and a switch that eventually gives up and drops the port onto its fallback VLAN. Nothing reached us, so there is nothing for us to have refused.

The service is called Wired AutoConfig, or dot3svc, and it needs to be both running and set to start automatically. Both halves matter: running but set to Manual works until the next reboot and then stops, which weeks later reads as an intermittent cable fault.

Passbeam's Intune step covers this in two pieces, kept deliberately apart. A platform script — Devices, Scripts and remediations, Platform scripts — sets the service to Automatic, starts it, and reads it back before reporting success. Separately, an Intune configuration profile under Templates, Wired network carries the 802.1X settings themselves, including which certificate the device should offer.

The script touches no network profile, so the two cannot conflict and the order they arrive in does not matter. Whichever lands second completes the pair.